In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe\/guc: Fix buffer overflow in steered register list allocation<\/p>\n
The size calculation for the steered register extarray uses only the
\ngeometry DSS mask (g_dss_mask) to determine the number of entries to
\nallocate:<\/p>\n
total = bitmap_weight(gt->fuse_topo.g_dss_mask, …) * steer_reg_num;<\/p>\n
However, the filling loop uses for_each_dss_steering(), which iterates
\nover for_each_dss(), defined as the union of g_dss_mask and c_dss_mask
\n(geometry + compute DSS). On platforms with compute-only DSS bits, the
\nloop writes past the allocated buffer, corrupting adjacent slab objects.<\/p>\n
This manifests as list_del corruption and SLUB redzone overwrites during
\ndrm_managed_release on device unbind, since the overflow corrupts the
\ndrmres list_head of neighboring allocations.<\/p>\n
Fix by computing the allocation size using the union of both DSS masks,
\nmatching the iteration pattern of for_each_dss_steering().<\/p>\n
—
\nv2:
\n– use bitmap_weighted_or() (Zhanjun)<\/p>\n
(cherry picked from commit 0a78a44f4901aa6c9263e66be7fce02282f1109f)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe\/guc: Fix buffer overflow in steered register list allocation<\/p>\n
The size calculation for the steered register extarray uses on<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5407","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5407","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}